@hordoffa1970 The error message “Failed to create. Configuration for port 9997 already exists” means the receiving port you’re trying to configure is already set up somewhere in your Splunk configuration. Port 9997 is the default receiving port for Splunk indexers, so if it’s already enabled, trying to add it again will trigger this message. You can check existing receiving configuration In Splunk Web by navigating to:  Settings → Forwarding and Receiving → Configure Receiving You should see port 9997 already listed. If 9997 is already active, you don’t need to add it again. Just confirm it’s listening. > Giving Karma & Marking the answer helps others find solutions faster! ... View more